Tourism & leisure — GDPR: bookings, international transfers and minors

What does GDPR cover?

The GDPR applies to customer and stay data. International partnerships involve transfers outside the EU requiring appropriate safeguards. Activities involving minors raise the level of requirements.

Each purpose (booking, marketing) requires its own legal basis and retention period.

Is the 'Tourism & leisure' sector concerned?

Tour operators, agencies, parks, clubs and accommodation providers are data controllers. Partners (carriers, platforms, foreign accommodation providers) are either controllers or processors.

Activities involving minors are subject to enhanced requirements.

Detailed obligations

Sanctions & risks

Fines of up to €20M or 4% of global turnover. Unframed transfers and the processing of minors' data are key points of vigilance.

Common mistakes in the sector

• 1Ungoverned transfers. Sharing data outside the EU without safeguards.
• 2Neglected minors. Processing children's data without due diligence.
• 3Non-compliant marketing. Prospecting without a legal basis.
• 4Excessive retention. Retain data beyond what is necessary.

Practical case

An agency was sharing client data with foreign hosting providers without any framework in place and managing stays for minors without appropriate information. The remediation establishes a framework for transfers, adapts information for families, and minimises data collection.

Compliance roadmap

1. 1

   Map. Mapping bookings, marketing, and minors.

2. 2

   Transfers. Governing international transfers.

3. 3

   Minors. Adapt information and minimisation.

4. 4

   Marketing/reviews. Frame.

5. 5

   Document. Maintain the register.

Frequently asked questions